deal with duplication of update-metadata

[webern]

Description

Having update-metadata duplicated in Bottlerocket and Twoliter is highly problematic because this is fundamental to how Bottlerocket operates. We probably need to publish this on crates.io.

sources/updater/update_metadata

Duplicating this makes me more than a little sad but I suppose in the short term it's unlikely to change given how difficult it us to evolve the format. It probably ought to be an independent crate, like bottlerocket-os/bottlerocket-update-metadata.

Originally posted by @bcressey in https://github.com/bottlerocket-os/twoliter/issues/37#issuecomment-1692429512

Definition of Done

When update-metadata is no longer duplicated in both Bottlerocket and Twoliter.